As you can see from the given code, the validation routine for “name” attribute of the “file” metalink element checks that the provided name is not empty and does not contain directory traversal characters. However, this does not check for names which are directories (meaning they end with ‘/’ character) as well as names containing single dots (“.”), double (“..”) and starting at the root directory.